#!/usr/bin/env python

""" Example for analyse URIs and Host for detect Zeus Malware """

__author__ = "Luis Campo Giralte"
__copyright__ = "Copyright (C) 2013-2020 by Luis Campo Giralte"
__revision__ = "$Id$"
__version__ = "0.1"

import sys
sys.path.append("../src/")
import pyaiengine

def callback_uri(flow):
    print("Zeus activity detected on flow", str(flow))

def callback_host(flow):
    h = flow.http_info
    if (h):
        host = str(h.host_name)
        if (host):
            print("Suspicious activity detected on flow", str(flow), host)

if __name__ == '__main__':

    stack = pyaiengine.StackLan()

    data = dict()
    # Load the hosts and Urls on memory
    # The list have been download from https://zeustracker.abuse.ch/blocklist.php?download=compromised
    h_mng = pyaiengine.DomainNameManager()
    with open("zeus.dat") as f:
        for line in f.readlines():
            l = line.strip()
            b = l.find("/")
            r_host = l[:b]
            r_uri = l[b:]
            if (not data.has_key(r_host)):
                h = pyaiengine.DomainName(r_host, r_host)
                s = pyaiengine.HTTPUriSet("Set for %s" % r_host)

                h.callback = callback_host
                h_mng.add_domain_name(h)
                h.http_uri_set(s)

                s.callback = callback_uri
                data[r_host] = (h, s)
         
            data[r_host][1].addURI(r_uri)

    """ Plug the DomainNameManager on the HTTPProtocol """ 
    stack.set_domain_name_manager(h_mng, "HTTPProtocol")

    stack.tcp_flows = 500000
    stack.udp_flows = 163840

    with pyaiengine.PacketDispatcher("eth0") as pd:
        pd.stack = stack
        pd.run()

    print(h_mng)

    sys.exit(0)

